Know how to deploy DSVA in a Guest Introspection (GI) and Service Insertion(SI) coexisted environment with VMware NSX-T 2.5.0. This is specifically for users who use Anti-malware solution but ony have nVDS Logical switch in the environment, or connecting Management interface to nVDS Logical switch instead of using VSS or VDS when deploy DSVA.
This solution is not supported from DSM Server version 12 FR 2020-06-17. The issue has been solved by VMware on NSX-T 3.0.
Before adopting the latest Deep Security solution, please consider the following upgrade flow:
- For new deployment users, please upgrade your NSX-T Manager to version 3.0.0 or later.
- For existed users, please keep your DSM server version below 12 FR 2020-06-17 or upgrade your NSX-T Manager to version 3.0.0 or later.
Please refer to the following deployment prerequisites:
- Upgrade DSM Server version to 12.5 FR-2020-01-27 (12.5.613) or later.
- Import DSVA 12.0 U3 (12.0.682) package to DSM Server.
- Setup HTTP Web server for DSVA deployment.
Refer to the KB article on Known issues when deploying Deep Security Virtual Appliance in VMware NSX-T 2.5 . - Allow DSM server communicate with DSVA via IP address.
Follow these steps for deployment:
- Keep DSM on version 12.0 and remove existing vCenter connector to unregister Partner Service Manager from NSX-T 2.5.0.
- Remove the DSVA service deployment plan.
- Remove the vCenter connector to force unregister Partner Service Manager from NSX-T 2.5.0 success. Check if the Partner Service has been removed.
- Upgrade the DSM server to 12.5 FR-2020-01-27 (12.5.613) or later.
- Enable DSVA with Coexist GI+SI function via dsm_c command from DSM server:
- Open Command Prompt or PowerShell with local administrator privilege.
- Switch working path to DSM default installed folder (ex: C:\Program Files\Trend Micro\Deep Security Manager).
- View default value of configuration item: settings.configuration.nsxtAllowNetworkFunctionality
settings.configuration.nsxtAllowNetworkFunctionality
>
.\dsm_c -action changesetting -name settings.configuration.nsxtAllowNetworkFunctionality -value true
Return the value: false - Change above configuration item with value ‘true’.
>.\dsm_c -action changesetting -name settings.configuration.nsxtAllowNetworkFunctionality -value true
- Add vCenter connector and NSX-T server from DSM web console. The DSM will register the GI+SI function to NSX-T. Sign on NSX-T web console > System > Service Deployment > CATALOG and it will show both “Endpoint Protection Policy” and “Next Generation Firewall” on Functionality.
- Copy the target DSVA packages (ex: dsva-12.0.0-682-small.ovf, dsva-12.0.0-682-small.mf and dsva-12.0.0-682-small.cert) from DSM\temp\Appliance-ESX-12.0.0-682.x86_64 to HTTP server.
Please note the DSVA packages for GI without build info. To deploy coexisting GI+SI DSVA, select packages with build info. - Modify the DSVA download URL from vCenter connector > NSX configuration.
For example: http://10.209.66.8:8080/small/dsva-12.0.0-682-small.ovfCheck if the URL is updated to NSX-T correctly. Click Deploy Service and check the icon from Deployment Specification. Dump the OVF URL for future deployment.
- Create Service Deployment plan from NSX-T to deploy DSVA.
Follow the general Service Deployment procedure same as GI in the Deep Security Help Center.
There are two required procedures during the deployment:- Select both ens0 and ens2 during the network configuration. The Network could be ESXI standard switch, Distribution Switch (VDS) and Logical Switch (nVDS).
- Creating a Service Segment is required. This will bind the Transport Zone used for SI function for coexisting GI+SI DSVA. Please note that the Service Segment is only allowed to be created from standard transport zone. The enhanced Transport zone is not supported.
- Select both ens0 and ens2 during the network configuration. The Network could be ESXI standard switch, Distribution Switch (VDS) and Logical Switch (nVDS).
- DSVA connect to nVDS Logical switch and activate success. From vCenter view:
From NSX-T view: